Internal agents
Leaving the lab.
Agents now hold authority that used to require human approval. The control question shifts from whether the API call worked to who authorized what, under which policy, and whether you can prove it.
Rules and Receipts
Monday morning, your auditor asks what your agents were refused on Friday night, and how they can trust the answer. This is what they get.
From policy to proof for agentic API access.
Define what an agent is allowed to do, enforce it at the gateway, and produce evidence humans and upstreams can trust.
Bind agent actions to human or platform authority; apply spend, scope, rate, and escalation limits before access; export the proof when your CISO, auditor, board, or incident reviewer asks what happened.
Sample, not a live receipt
x402 in this sample is USDC on Base
{
"evidence_pack_id": "ep_demo_2026_05_09_001",
"policy_version": "pol_invoice_reconciliation@2026-05-09",
"issued_at": "2026-05-09T14:22:31Z",
"expires_at": "2026-05-16T14:22:31Z",
"tenant": "acme-finance",
"subject": "worker-agent:invoice-reconciler",
"payment_context": {
"default_market": "internal_enterprise_agents",
"optional_external_rails": [
"x402",
"l402"
]
},
"authority_chain": [
{
"kind": "root_grant",
"subject": "finance-agent:automation",
"issuer_kid": "satgate-mint-2026-05",
"caveats": [
"tenant_id = acme-finance",
"delegation_depth = 1"
]
},
{
"kind": "delegation",
"subject": "worker-agent:invoice-reconciler",
"parent": "finance-agent:automation"
}
],
"receipts": [
{
"receipt_id": "rcpt_spend_search_003",
"evidence_pack_id": "ep_demo_2026_05_09_001",
"policy_version": "pol_invoice_reconciliation@2026-05-09",
"type": "spend",
"ts": "2026-05-09T14:23:18Z",
"route": "/v1/invoices/search",
"amount_usd": "0.18",
"payment_protocol": "internal_api",
"settlement": {
"cost_center": "FIN-AP-042"
},
"decision_reason": "allowed_under_policy",
"result": "allowed",
"receipt_hash": "sha256:01d8..."
},
{
"receipt_id": "rcpt_spend_compare_004",
"evidence_pack_id": "ep_demo_2026_05_09_001",
"policy_version": "pol_invoice_reconciliation@2026-05-09",
"type": "spend",
"ts": "2026-05-09T14:24:02Z",
"route": "/v1/invoices/compare",
"amount_usd": "0.42",
"payment_protocol": "internal_api",
"settlement": {
"cost_center": "FIN-AP-042"
},
"decision_reason": "allowed_under_policy",
"result": "allowed",
"receipt_hash": "sha256:a923..."
},
{
"receipt_id": "rcpt_paid_ocr_005",
"evidence_pack_id": "ep_demo_2026_05_09_001",
"policy_version": "pol_invoice_reconciliation@2026-05-09",
"type": "spend",
"ts": "2026-05-09T14:24:44Z",
"route": "/v1/invoices/ocr",
"mcp_tool": "document_ai.ocr",
"amount_usd": "0.18",
"payment_protocol": "x402",
"settlement": {
"chain": "base",
"tx": "REDACTED_DEMO_SAMPLE",
"ms": 187
},
"decision_reason": "allowed_under_policy",
"result": "allowed",
"receipt_hash": "sha256:deb5..."
},
{
"receipt_id": "rcpt_denial_scope_006",
"evidence_pack_id": "ep_demo_2026_05_09_001",
"policy_version": "pol_invoice_reconciliation@2026-05-09",
"type": "denial",
"ts": "2026-05-09T14:25:08Z",
"decision_reason": "scope_violation:no_customer_data_export",
"reason_code": "scope_violation:no_customer_data_export",
"result": "blocked",
"receipt_hash": "sha256:9b0f..."
},
{
"receipt_id": "rcpt_denial_budget_007",
"evidence_pack_id": "ep_demo_2026_05_09_001",
"policy_version": "pol_invoice_reconciliation@2026-05-09",
"type": "denial",
"ts": "2026-05-09T14:25:33Z",
"decision_reason": "budget_exhausted",
"reason_code": "budget_exhausted",
"result": "blocked",
"receipt_hash": "sha256:c3f6..."
}
],
"signature": "ed25519:REDACTED_DEMO_SAMPLE_DO_NOT_VERIFY"
}Inline hashes are shortened for readability. Full hashes, payment rail context and a placeholder signature are in the downloadable sample.
Internal first, rail-aware when needed
Built for internal enterprise agents. Extends across paid external calls.
Most enterprise agents do not need a wallet to call internal APIs. They need bounded delegated permissions, budget controls, revocation, and audit evidence around the credentials they already have.
When that same internal workflow crosses into an external paid API, SatGate keeps the proof intact: internal scope and delegation, plus spend attribution for x402 and L402 payments.
Why now
Agents are moving from demos to workflows. Spend rails are arriving with them.
Teams need limits and receipts before agents spend at scale. Payment rails authorize value movement. SatGate authorizes behavior and preserves proof. A payment shows money moved. SatGate’s receipt shows what SatGate decided.
Paid calls
Becoming part of the path.
x402, L402, AgentCore Payments, Pay.sh and similar payment methods make it easier for agents to call paid services. SatGate adds policy, limits and receipts around x402 and L402 today. AgentCore Payments and Pay.sh are planned.
Enterprise scale
Authority before scale.
CISOs, platform teams, and FinOps leaders need more than logs after the fact. They need evidence that each action matched policy before agents trigger budget, data access, or external execution.
SatGate
Sits in front of your APIs.
SatGate signs a receipt when it refuses an agent over a budget, a missing payment or a tool permission, and when an agent spends from a budget in Control. This covers HTTP APIs and MCP tools.
The contrast
Logs tell you something happened. A signed receipt shows what SatGate decided.
Other gateways
200/402 status codes in a log.
Today you piece it together from logs, invoices, shared API keys and screenshots.
SatGate
Signed receipts anyone can check, exportable as a list.
The signed receipt (Evidence Pack) is not a logging afterthought. It is generated by the same authority path that enforces the decision.
Six-question evidence framework
Answer the audit questions after the invoice-reconciler acts.
Receipts and the audit log answer these questions without a forensics project across logs, invoices and gateway dashboards. Token lineage shows who handed work to whom, and the signed receipts show what SatGate refused and what was spent in Control.
Who authorized this?
Mint record
The audit log entry for the token issued to the invoice-reconciler worker.
Which agent got access?
Capability token + delegation chain
The root capability, parent agent, invoice-reconciler worker, and every narrowing in the handoff path.
What exactly could it do?
Scope + caveat record
Routes, tools, tenant boundary, expiry, budget, delegation depth, and revocation status at issue time.
What did it spend?
Per-token spend ledger
Attribution of each request that goes through SatGate, and of MCP tools, by worker, token, tenant, route, amount, and policy mode.
What was denied?
Denial receipt
A budget, missing-payment or tool-permission reason code attached to the blocked invoice call.
Does revoke work?
Post-revoke denial
Try the token again: the next request is refused.
For audit teams
Records an auditor can check.
Each receipt carries a hash, the decision and a refusal code, so security and audit teams don't start from raw gateway logs.
Delegation chain
Narrower permissions for each helper
Least-privilege narrowing across parent and worker permissions.
Spend ledger
Spend by token
Which token spent what, on which route or tool.
Who receives the pack
One export, three enterprise conversations.
Receipts for refusals and spending in one export, checkable against SatGate’s published keys.
A revoke that holds: the next request after it is refused.
Spend tied to the agent’s token and the route, not a shared API key.
Want this for your stack?
Bring an API, an agent workflow, and the evidence your auditor already asks for.
Demo path
Mint → Delegate → Spend → Deny → Revoke → Export.
The demo ends on the exported receipts across the invoice-reconciler lifecycle.
Read the six-step lifecycle below, or watch the 90-second cut.
1
Mint
invoice-reconciler gets a scoped macaroon capability with tenant, budget, route, and expiry caveats.
2
Delegate
The parent finance agent hands narrower authority to the worker; the chain is preserved.
3
Spend
The worker calls invoice APIs or MCP tools under budget; the ledger updates by token and path.
4
Deny
Export and over-budget calls return reason-coded receipts before data or spend escapes.
5
Revoke
Security kills the worker capability without rotating every upstream provider key.
6
Export
The workflow's signed receipts are exported as a list a CISO, auditor or incident reviewer can read.
Receipt walkthrough
See how receipts work.
Watch a governed agent receive scoped authority, delegate work, hit policy decisions, and export a signed receipt your security and audit teams can review.
What you get
SatGate lets you give AI agents limited permissions, and signs receipts anyone can check.